0

Is it possible to install the windows update KB3042553 for Windows Server 2008 Standard? We had a Vulnerability Assessment & Penetration Test completed recently and this was the only critical item that came up. Everything points that this update is intended for Windows Server 2008 R2, but we are unsure if this would actually work with Windows Server 2008 Standard.

  • I'm curious as to how you're patching your servers now. Is Windows Update Services in your environment? WSUS would identify the needed updates for the server and let you decide if and when to apply them. – Morrow Feb 19 '16 at 1:08
1

Sorry if this sounds trite, however, have you tried to install it? The installer with throw up an error if there is a version mismatch.

  • Good point. Even though I can't find any info that it is applicable to 2K8, the suggestion to run the installer is a good one as the installer will prevent itself from installing if it isn't applicable. – joeqwerty Feb 18 '16 at 21:29
  • Thank for your answer. I did try to install the update and it would not run. – j.niemeyer Apr 21 '16 at 20:10
0

MS15-034 wasn't issued for Server 2008. Ask your security consultants how they came to the conclusion that it should be installed on that server.

If they figured it out by some dynamic method like attempting the exploit, you should open a case with Microsoft (or upgrade your servers, but since Server 2008 is in extended support until 14 January 2020, you should be getting security updates).

If they figured it out by querying patch status and OS version, they are likely in error and you should discuss the contents of the security bulletin with them. A good security consulting company will work with you to find the appropriate solution.

Take a look at the bulletin (https://technet.microsoft.com/library/security/MS15-034) and you will find that the problem is related to kernel caching in IIS. You could disable that (in lieu of patching), but on the other hand, the bulletin is not issued for your OS version.

  • Thanks for your suggestion. We talked to the company that was running the pen test and turned out to be a false positive. – j.niemeyer Apr 21 '16 at 20:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.